Description (CNA)
OpenBK7231T's /cfg_wifi_set endpoint (src/httpserver/http_fns.c) accepts configuration changes via a plain GET request with no CSRF token. If the parameter is absent from the request, an else-branch silently clears the device's web admin password to an empty string.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| openshwprojects / OpenBK7231T_App | affected 0 through * |
CWE
CWE-352
References
- https://github.com/openshwprojects/OpenBK7231T_App
- https://github.com/openshwprojects/OpenBK7231T_App/blob/main/src/httpserver/http_fns.c
ADP enrichment
No English description supplied.
No references supplied.